Cyber insurance in 2026 is cheaper to buy than it was two years ago, but it isn't easier to qualify for. Canadian cyber rates fell 5% in the first quarter of 2026 and 6% in the second, according to the Canada data in Marsh's Global Insurance Market Index (Canadian Underwriter, April 23, 2026 and July 29, 2026). What hasn't eased is the list of security controls an underwriter expects to see before they'll quote.
For Ontario small and mid-sized businesses, that makes cyber insurance close to a pass or fail test. If the core controls are in place and you can show them, you'll find more insurers competing for your business. If they aren't, a lower market rate doesn't help you, because you may not get a quote at all, or you'll get one with exclusions that matter when you make a claim.
This guide covers the cyber insurance requirements underwriters ask about most, why each one matters, how insurers check, and the policy gaps worth reading for before you renew.
Key Takeaways
- Rates are down, but requirements aren't. Canadian cyber rates fell 5% in Q1 2026 and 6% in Q2, yet insurers still expect MFA, tested backups, EDR and an incident response plan before they'll quote.
- Only 22% of Canadian small and mid-sized businesses surveyed carry any cyber insurance, and just 12% have a standalone policy (Insurance Bureau of Canada, 2025).
- Remote access is where most ransomware gets in. At-Bay found remote access tools were the entry point in 80% of the ransomware attacks it studied.
- Social engineering and funds transfer fraud cover is often a smaller sub-limit inside your policy. Check the number before you assume a deepfake payment scam is covered.
- Insurance pays for some of the damage. It doesn't replace your duties under PIPEDA or the controls that stop the attack in the first place.
Are cyber insurance premiums going up in 2026?
No. For most Canadian businesses they're going down. Marsh reported that global cyber insurance rates fell 5% in Q1 2026 and 4% in Q2 2026, the twelfth consecutive quarterly decrease, as insurers competed for business (Marsh, July 23, 2026). Canada's cyber rates fell slightly faster than the global average in Q2.
So why are requirements still strict? Because cyber has been an expensive line for Canadian insurers. Canadian cyber insurance ran a combined ratio averaging 153% from 2019 to 2023, meaning insurers paid out far more in claims and costs than they took in as premiums (Insurance Bureau of Canada, July 2024). Canadian Underwriter reports that insurer capacity has grown, including from new entrants, so prices are falling, but underwriters are still selecting their risks carefully. The best quotes go to businesses that show the right controls.
Many businesses haven't bought cover at all. In an Insurance Bureau of Canada survey of 308 owners and decision makers at businesses with up to 500 staff (Angus Reid, August 2025), only 22% carried cyber insurance and 12% had a standalone policy (IBC, October 2025).
The upshot is that insurance has become a reward for good security, not a substitute for it.
What are the cyber insurance requirements in 2026?
Most insurers work from a similar core list. Marsh, one of the largest brokers, lists 12 key controls and notes that "the adoption of certain controls has now become a minimum requirement of insurers" (Marsh Canada). The Canadian Centre for Cyber Security's baseline controls for small and medium organizations cover much of the same ground and are a good, free starting checklist.
The table below groups the requirements that show up most often on applications, and shows where each one appears in the Cyber Centre's baseline, so you can use one free government checklist to work toward what insurers ask for.
| Requirement | What underwriters usually expect | In the Cyber Centre baseline? |
|---|---|---|
| Multi-factor authentication | MFA on email, all remote access and every admin account. Phishing-resistant methods are preferred. | Yes: strong user authentication |
| Backups | Encrypted backups, with at least one copy offline or immutable, and restores that are tested | Yes: backup and encrypt data |
| Endpoint detection and response (EDR) | EDR on every laptop and server, ideally monitored around the clock | Partly: enable security software (EDR goes further than antivirus) |
| Patching and vulnerability management | Critical patches applied quickly, especially on internet-facing systems; no unsupported software | Yes: automatically patch operating systems and applications |
| Privileged access | Separate admin accounts, no shared admin passwords | Yes: implement access control and authorization |
| Email security and training | Email filtering plus regular phishing awareness training | Yes: provide employee awareness training; perimeter defences |
| Incident response plan | A written plan that says who to call, including the insurer's hotline | Yes: develop an incident response plan |
Knowing the requirements is half the job. The other half is answering the application accurately and keeping evidence for each answer, because a wrong answer can sink a claim later. Our guide on how to answer your cyber insurance questionnaire walks through each common question.
The controls that decide your quote
Not every control carries the same weight. These five are the ones most likely to change your premium, your terms or whether you're offered cover at all.
Phishing-resistant MFA, not just text codes
Having MFA is no longer enough on its own. Insurers want to know where it's turned on and what kind it is. The Canadian Centre for Cyber Security recommends phishing-resistant MFA and says FIDO-based solutions, such as hardware security keys and passkeys, are "strongly recommended" (Cyber Centre, ITSAP.30.030). SMS codes are the weakest common option, because a text message can be intercepted or the phone number hijacked through SIM swapping.
What this means in practice: move admins and finance staff to hardware keys or passkeys first, and use an authenticator app with number matching for everyone else. Any MFA beats none, but an application that asks about "phishing-resistant MFA" is asking about more than text messages. Cynerra's multi-factor authentication service covers the rollout.
Backups that ransomware can't delete
Older applications often asked only whether you had backups. Newer ones ask whether the backups are separate from your main network, encrypted and tested. The Cyber Centre's baseline controls say long-term backups "must be stored offline."
Here's an illustrative example. Picture an engineering firm in Hamilton whose backups sit on a server that uses the same administrator login as everything else. An attacker who takes that login can delete the backups before launching ransomware. With immutable backups (copies that can't be changed or deleted for a set period, even by an admin), the firm can restore without paying.
This matters for claims too. In Coalition's 2026 Cyber Claims Report, ransomware was the costliest claim type, averaging US$269,000 per claim in 2025, and 86% of businesses hit chose not to pay the ransom. Coalition links that refusal rate to viable backups and incident response plans (Coalition, March 2026). See our backup and disaster recovery service for how immutable backup works.
EDR or MDR instead of traditional antivirus
Signature-based antivirus is now treated as a legacy tool. Applications ask specifically about endpoint detection and response, which watches behaviour on each device and can isolate a machine mid-attack. Many also ask whether someone monitors those alerts 24/7, which is what managed detection and response (MDR) provides.
At-Bay's 2025 analysis of its ransomware claims found that every company that avoided encryption had one thing in common: a professionally managed EDR solution (At-Bay, November 2025). The business outcome is simple. An alert that's caught at 2 a.m. is a contained incident, while one that's found at 9 a.m. can be a company-wide outage.
Secure remote access
Remote access is where many attacks start, and insurers know it. At-Bay found that 80% of ransomware attacks against its insureds in 2024 started from remote access tools, and that businesses running Cisco or Citrix VPNs were 6.8 times as likely to fall victim to ransomware as businesses with no detectable VPN (At-Bay, November 2025).
If you still expose remote desktop (RDP) or an older VPN appliance to the internet, expect questions, and possibly a requirement to replace it or put it behind MFA as a condition of cover. Regular vulnerability management finds these exposures before the insurer's scan does.
An incident response plan and the insurer's panel
Many policies come with a panel of incident response firms, often lawyers, forensic investigators and communications specialists, that you're expected to call first. Chubb Canada, for example, says its cyber policies "provide an expert panel of incident response services providers", reachable 24/7 by app or hotline (Chubb Canada).
Your incident response plan should name that hotline, your policy number and who in the business can authorize the call. That way you don't lose the first day of an outage working out who to ring and whether the insurer will pay for them. Check your wording before you call anyone else, because a firm that isn't on the panel may not be covered unless the insurer agrees first.
How do insurers check your cyber security?
They ask you, and increasingly they check from the outside. Some insurers scan the internet-facing side of your business, looking at things like open ports, exposed remote access and unpatched systems, as part of underwriting. Coalition describes its scanning as like "a property inspection, but for cyber exposures" (Coalition).
That changes the conversation at renewal. If the scan finds an exposed login page or an out-of-date firewall, the insurer may raise the price, add a condition, or ask you to fix it before binding. It also means a "yes" on the application that the scan contradicts gets noticed. A short cyber security risk assessment before renewal shows you what they'll see.
Social engineering sub-limits: the gap in many policies
Your policy's headline limit isn't always the amount that applies. Social engineering and funds transfer fraud, where staff are tricked into sending money, are often covered under a separate, lower sub-limit. Lesley Rowe of Trisura told Insurance Business Canada that social engineering cover has traditionally been "a small sublimit", and that brokers are now asking insurers for higher limits (Insurance Business Canada, August 2026). It varies by insurer, though. Coalition, for one, says its policies cover funds transfer fraud at full limits (Coalition), so check the wording you're actually offered.
Here's how the gap works, with illustrative numbers. Say you have a $1 million cyber policy with a $100,000 social engineering sub-limit. An employee wires $150,000 to a fake "vendor" after a convincing phone call. The policy pays up to $100,000, and the business absorbs the other $50,000, plus the deductible.
These scams are no longer rare. The Canadian Anti-Fraud Centre recorded $67.9 million in reported spear phishing losses in 2025, the category that covers business email compromise (CAFC, February 2026). The CAFC and the Cyber Centre have also warned that criminals are using AI to mimic the voices of executives and senior officials (CAFC and Cyber Centre, June 2025). The fix is a process, not a product. Call back on a number you already have before you change any payment details, and require two people to approve any change to a vendor's bank details. Our article on phishing beyond email covers voice and Teams-based scams in more detail.
What cyber insurance doesn't replace
A policy transfers some financial risk. It doesn't transfer your legal obligations. Under PIPEDA, you must protect personal information with safeguards appropriate to its sensitivity (Office of the Privacy Commissioner). The law doesn't name a product that satisfies this. It's a judgment about whether your security fits the data you hold. If a breach creates a real risk of significant harm, you must report it to the Privacy Commissioner, notify the people affected, and keep records of every breach for two years (OPC). Health information custodians in Ontario have separate duties under PHIPA.
That's why we tell clients to treat cyber insurance as the last line of defence, not the first. If you're relying on the policy to save you, the attack has already succeeded. Businesses are in a stronger position when they pair a solid policy with controls that stop most attacks early and an IT partner who can produce the logs, MFA reports and backup proof the insurer asks for.
Frequently asked questions
Why hasn't my premium dropped like the market?
Market averages hide wide differences between businesses. Your premium depends on your industry, revenue, claims history and how your controls compare with what the insurer expects. If a scan or your application shows gaps, such as MFA that doesn't cover remote access, you may see flat pricing or new conditions while better-protected businesses get reductions. Closing those gaps before renewal gives your broker something to negotiate with.
Does my cyber policy cover AI deepfake fraud?
Often, but usually under a social engineering or funds transfer fraud section with its own sub-limit, and sometimes only if staff followed a verification procedure such as a call-back. Check your declarations page for the sub-limit amount and the policy wording for any verification conditions.
What is "bricking" coverage?
Some attacks damage firmware so badly that a device, such as a server, laptop or firewall, has to be replaced rather than repaired. Bricking coverage pays for that hardware. At-Bay notes that this coverage "often isn't included in base policy forms" (At-Bay), so ask your broker whether yours includes it, especially if you run equipment that's expensive to replace.
Does business interruption cover start immediately?
Usually not. Most policies have a waiting period before lost income is covered, typically between 6 and 12 hours, though some have none and others are longer than 24 hours, according to US insurance agency Insureon (Insureon, November 2025). Canadian wordings vary, so check yours. If tested backups get you running again within a few hours, you may not need to claim at all, which protects your claims history at renewal.
Your cyber insurance requirements checklist for renewal
- Read your sub-limits. Find the amounts for ransomware, social engineering, funds transfer fraud and regulatory costs on your declarations page, and ask about bricking cover.
- Audit your MFA. Confirm it covers email, every remote access path and all admin accounts. Move admins and finance staff off SMS first.
- Test your backups. Ask your IT provider to prove that at least one copy is offline or immutable, and to show the date of the last successful test restore.
- Confirm EDR coverage. Check that every device is reporting in, and who responds to alerts outside business hours.
- Close exposed remote access. Remove internet-facing RDP and replace or patch old VPN appliances.
- Update your incident response plan. Add the insurer's hotline, your policy number and the panel firms.
- Gather the evidence before you fill in the application. Then answer it accurately, using our questionnaire guide.
For a wider view of where to start, see our small business cybersecurity guide.
Want us to check your insurability gaps?
Cynerra reviews cyber insurance readiness for Ontario businesses. We check your MFA coverage, backup immutability, EDR and remote access against what underwriters ask for, and give you a dated plan for any gaps before your renewal. Learn more about our cybersecurity insurance evaluation, email [email protected] or contact us.
